Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Capturing TCPDUMP
Operating Systems Linux Capturing TCPDUMP Post 302222645 by buffoonix on Thursday 7th of August 2008 09:00:54 AM
Old 08-07-2008
There's another issue with your dump command
I would guess by merely looking at it.
Quote:
tcpdump -s0 -vv -w /home/osuresh/test_tcp_dump host 10.12.10.22 && port 161
If you insist on using && I would think you will have to escape each ampersand,
or single quote the entire tcpdump logical expression
to prevent the probably non-existing command port 161 from being tried to be executed by the shell after the preceding tcpdump has finished successfully.
If you are too lazy to escape you could as well replace && by and.
Also, as far as I remember tcpdump will grab the first NIC if you don't explicitly tell it
by -i ethN which one to use.
You could as well use -i any to let it sniff on every available NIC
but then it wouldn't set them into promiscuous mode,
which probably anyway would be wiser altogether because you are generally only interested in packets destined for your host.
So it's save to add -p.
Quote:
I could observe tcpdump in /usr/sbin/
but not sure if I need to execute:
tcpdump -s0 -vv -w /usr/sbin/tcpdump host 10.12.10.22 && port 161
Please no, (I'm not even sure if tcpdump would allow such stupid abuse)
but by that you would tell it to overwrite its own executable with the dump it filtered!
What the others meant was to give the full path to the command
in case your root user hadn't /usr/sbin in his $PATH
which seems quite unlikely anyway.
e.g.
Code:
# /usr/sbin/tcpdump -p -i eth0 -s0 -w /home/osuresh/test_tcp_dump 10.12.10.22 and port 161

Given the difficulties you already encounter properly executing the command
I am afraid I am a bit suspicious if you know what to do with the dump in the end?
 

10 More Discussions You Might Find Interesting

1. Programming

How To Use tcpdump

I have two net-card. one is 172.16.24.99(ENG) ,another is 172.16.25.99(ENG-B). Both masks is 255.255.255.0. I will monitor data on the tcp port 8055 in ENG, How do I set option of tcpdump command (2 Replies)
Discussion started by: chenhao_no1
2 Replies

2. UNIX for Dummies Questions & Answers

tcpdump

does anybody know what the -d -dd and -ddd options are used for ? thanks (2 Replies)
Discussion started by: ant04
2 Replies

3. Cybersecurity

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (0 Replies)
Discussion started by: chamnanpol
0 Replies

4. IP Networking

i would like to know about tcpdump

i would like to know about tcpdump i would like to use tcpdump to get information about these - Date - time - source hostname - source mac address - source ip address - destination ip address - see outbound only then i use command like this tcpdump -i le0 -n -q -tttt -e src net... (2 Replies)
Discussion started by: chamnanpol
2 Replies

5. IP Networking

tcpdump -w file is not capturing all the packets

I am trying to capture tcpdump for traffic to a port in a file but this does not seem to capture all the packets. Command I use is : tcpdump -w tdump.dat port 22 Why is it not capturing all the packets ? Here is my experiment: root@pmode-client6 adc-demo]# tcpdump port 22 tcpdump:... (5 Replies)
Discussion started by: radiatejava
5 Replies

6. Shell Programming and Scripting

TCPdump script

I'm new to the Unix/Linux world. I have taken classes and played with a few simple scripts but never had a real world application. Here is my problem. What I need to do is every 15min between 8am and 5pm, run tcpdump -s 2000 -w flowroute-0000.pcap where the "0000" is the current time. ... (4 Replies)
Discussion started by: Nasasdge
4 Replies

7. Debian

Tcpdump Help !

Hi. Need Help with TcpDump Trying to sniff associatio-request with tcpdump but when i run this tcpdump -i eth0 wlan subtype assoc-req i get this error can anyone help me with this error ? Thanks alot !!:) (1 Reply)
Discussion started by: SoulZB
1 Replies

8. Cybersecurity

Need Help with this TCPDUMP output...

Hello everyone, so I'm getting this tcpdump, and it looks like..quite a mess... Can anyone decipher this? I can tell that one IP is requesting DNS info? but I'm having trouble finding out what some of the fields actually mean.. 19:44:50.707637 IP 66.81.1.252.53 > 64.147.113.139.28638: 52313... (4 Replies)
Discussion started by: Lost in Cyberia
4 Replies

9. UNIX for Dummies Questions & Answers

How to update tcpdump?

I would like to update tcpdump on my computer (CentOS 6.5) which is currently old. I download the zip file from TCPDUMP/LIBPCAP public repository already but I don't know how to update with this file. I have to delete tcpdump on my computer first? Would you please provide the step for me? (0 Replies)
Discussion started by: thsecmaniac
0 Replies

10. IP Networking

TCPdump

I've recently started learning to use TCPdump, and I find it pretty interesting. There's one thing I don't understand. When I tell it to capture packets on, say, the WiFi interface en1, it often captures packets sent or received by other hosts on the network. How can it do this? My... (3 Replies)
Discussion started by: Ultrix
3 Replies

LEARN ABOUT DEBIAN

tttprobe

tttprobe(1)								net							       tttprobe(1)

NAME

       tttprobe - Tele Traffic Tapper probe -  A probe to collect local traffic-data and send it to a remote instance of tttview

SYNTAX

       ttt [-interface device] [-interval ms] [-multicast] [-port dest_port] [-ttl time-to-live] [Destination]

DESCRIPTION

       tttprobe  is  the probe program in the ttt program suite. tttprobe locally collects traffic-data and sends it over a network to an instance
       of tttview.

       To run tttview, it is not necessary to be "root".

       The ttt program suite is yet another descendant of tcpdump but it is capable of real-time, graphical, local and remote  traffic-monitoring.
       It won't replace tcpdump, rather, it helps you find out what to look into with tcpdump.

OPTIONS

       ttt [-interface device] [-interval ms] [-multicast] [-port dest_port] [-ttl time-to-live] [Destination]

       -interface device
	      specifies the interface for packet capture. If not specified, the default interface is chosen.

       -interval ms
	      Sets the interval in Milliseconds. If omitted, a interval of 1000 msec. is used as default.

       -multicast
	      Shorthand for the default multicast destination "224.8.8.0".

       -port dest_port
	      Specifies the udp port number on the remote host where the traffic-data should be sent to. If omitted, port 7288 is used as default.

       -ttl time-to-live
	      Specifies the time-to-live for multicast. If omitted, 1 is used as default to restrict the multicast to the local subnet.

       Destination
	      Specifies  the  remote  host  where the traffic-data should be sent to. Destination can be omitted only, if -multicast is specified.
	      Destination can be a uni- or multicast address.

EXAMPLES

       Remark: "hostA" is allways the host where traffic-data is collected with tttprobe and "hostB" is allways the host where the traffic-data is
       displayed with tttview.

       point-to-point monitoring:

	      hostA: tttprobe hostB
	      hostB: tttview

	      or:

	      hostA: tttprobe ip_of_hostB
	      hostB: tttview

       multicast:

	      when using the default multicast address:

	      hostA: tttprobe -multicast
	      hostB: tttview -multicast

	      this is equivalent to:

	      hostA: tttprobe 224.8.8.0
	      hostB: tttview -addr 224.8.8.0

AUTHORS

       tttprobe was written by Kenjiro Cho < kjc@csl.sony.co.jp>.

       This  manual page was written by Thomas Scheffczyk <thomas.scheffczyk@verwaltung.uni-mainz.de>, for the Debian GNU/Linux system (but may be
       used by others).

SEE ALSO

       ttt(1), tttview(1)

Kenjiro Cho								1.7							       tttprobe(1)
All times are GMT -4. The time now is 05:38 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy